CVE-2026-66141: Exim Privilege Escalation Vulnerability

CVE-2026-66141 Overview

CVE-2026-66141 is a local privilege escalation vulnerability in the Exim mail transfer agent affecting versions before 4.99.5. The flaw stems from mishandling of force_command when Exim processes a pipe transport invoked through a user's .forward file. An attacker with a local mailbox can leverage this behavior to execute commands with elevated privileges beyond those authorized by the transport configuration. The issue is classified under [CWE-829: Inclusion of Functionality from Untrusted Control Sphere].

Critical Impact
Local users can escalate privileges by abusing .forward files to execute commands through Exim's pipe transport, compromising confidentiality, integrity, and availability of the mail host.

Affected Products

Exim mail transfer agent versions prior to 4.99.5
Systems using .forward files with pipe transports
Unix and Linux distributions shipping vulnerable Exim packages

Discovery Timeline

2026-07-22 - Advisory published on the Openwall oss-security mailing list
2026-07-24 - CVE-2026-66141 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66141

Vulnerability Analysis

Exim supports user-controlled mail routing through .forward files, which can redirect messages to files, addresses, or external commands via a pipe transport. Administrators use the force_command directive to restrict pipe execution to a fixed command, overriding any user-supplied argument. In versions before 4.99.5, Exim mishandles force_command when the pipe transport is invoked through .forward. The mishandling breaks the intended restriction and allows the local user's command specification to influence execution. Because pipe transports commonly run with elevated privileges tied to the delivery user, the flaw yields local privilege escalation on the mail host.

Root Cause

The root cause is improper enforcement of the force_command transport option along the .forward delivery path. Exim fails to override the untrusted command with the configured trusted command before invoking the pipe transport, allowing user-controlled functionality from an untrusted control sphere to execute [CWE-829].

Attack Vector

Exploitation requires local access with the ability to write a .forward file for a mailbox and to trigger mail delivery to that mailbox. The attacker crafts a .forward entry that abuses the pipe transport path where force_command should have constrained execution. Upon message delivery, Exim invokes the pipe transport under the delivery user's privileges, executing attacker-influenced commands. The attack complexity is high because it depends on specific transport configurations and delivery timing, but no user interaction or prior authentication to Exim is needed beyond local shell access.

No verified proof-of-concept code is publicly available. Refer to the Openwall OSS Security Update for the technical write-up.

Detection Methods for CVE-2026-66141

Indicators of Compromise

Unexpected .forward files in user home directories containing pipe (|) directives referencing shells or interpreters
Child processes spawned by the Exim delivery process that do not match the force_command configured binary
Mail log entries in mainlog showing pipe transport executions with argument strings that diverge from the transport's declared command
New setuid or world-writable files created shortly after mail delivery events

Detection Strategies

Audit all user-writable .forward files across the mail host and compare their pipe directives against approved delivery agents
Monitor process ancestry for Exim (exim, exim4) parent processes launching shells such as /bin/sh, bash, perl, or python
Correlate Exim mainlog pipe delivery entries with process execution telemetry to identify command mismatches against force_command

Monitoring Recommendations

Ingest Exim mainlog, rejectlog, and paniclog into a centralized log platform and alert on pipe transport anomalies
Track the installed Exim package version across hosts and flag any system running a release earlier than 4.99.5
Alert on modifications to .forward, .procmailrc, and system alias files under /etc/aliases

How to Mitigate CVE-2026-66141

Immediate Actions Required

Upgrade Exim to version 4.99.5 or later on all mail hosts
Inventory .forward files and remove or restrict pipe directives that are not explicitly required
Review pipe transport definitions to confirm force_command is set where user forwarding is permitted
Restrict local shell access on mail relays to reduce the pool of users capable of writing a .forward

Patch Information

Upgrade to Exim 4.99.5 or later, which corrects the handling of force_command for pipe transports invoked through .forward. Consult your Linux distribution's security advisories for backported package versions and refer to the Openwall OSS Security Update for the upstream fix reference.

Workarounds

Disable user .forward processing by setting check_local_user = false or removing the redirect router that reads .forward
Set allow_filter = false and forbid_pipe = true on the redirect router to block pipe directives in user forward files
Restrict the pipe transport user and group to a low-privileged account, and constrain command to an absolute path with no shell metacharacters

bash

# Example redirect router hardening in /etc/exim/exim.conf
userforward:
  driver = redirect
  check_local_user
  file = $home/.forward
  allow_filter = false
  forbid_pipe = true
  forbid_file = true
  no_verify